There is a lot security professionals disagree on when it comes to Identity & Access Management (IAM). One thing most would agree on though is that IAM means many things to many people, and has been shaped more by vendor product boundaries over the years than by overarching architectures, processes and governance. The basic term “Identity Management...

2016 marks the ninth year Verizon has published its annual Data Breach Investigations Report (DBIR). Once again, organizations sent their data on thousands of security incidents and data breaches to Verizon, whose researchers analyzed that information to highlight new patterns, steady trends, and interesting tidbits in the evolving digital threat...

A recent hacking competition challenged teams of cyber security students from some of the United Kingdom's top universities. On Saturday, April 23, the University of Cambridge hosted the Inter-ACE Cyberchallenge 2016, a two-competition ethical hacking event between the UK Academic Centres of Excellence in Cyber Security Research. Dr. Frank Stajano,...

Researchers have developed a utility that allows victims affected by CryptXXX ransomware to decrypt their files for free. CryptXXX is one the newest crypto-ransomware samples to be observed in the wild. It is being delivered to users as a Dynamic-Link Library (DLL) dropped by Bedep, a piece of malware which has the ability to download additional...

Data breaches pose a significant threat to each and every organization. The danger is that a group of attackers will not only gain an initial foothold into a company's systems but will also find a way to conceal any signs of their entry. By covering their tracks, they can remain undetected on corporate networks for a longer period of time, allowing...

The healthcare landscape has many challenges – security being at the forefront. Ransomware attacks grow increasingly rampant with each day and healthcare is the perfect target due to hospitals relying on antiquated technology that alerts them only after the infection occurs. Cybercriminals are always on the forefront and looking at innovative ways...

Shopware has patched a 'critical' remote code execution bug that affects the functions of both the shop and the overall system. According to a thread posted on Bugtraq, David Vieira-Kurz, a security engineer at Immobilien Scout GmbH, found that the script located at "/backend/Login/load" in Shopware's eCommerce platform is susceptible to remote code...

Technology infrastructure (TI) at banks involves a dizzying array of things – from employee laptops and desktops, software applications, and hosting networks to networking and cabling linking offices around the world, Internet of Things (IoT) devices, sophisticated enterprise tools, data centers... and so on. Just as a country needs its critical...

As I discussed in last week's post, smartphones, tablets, desktops, industrial equipment, servers and other technologies that connect to a corporate network are considered endpoints. Unfortunately, bad actors can abuse those devices and their network access to attack an organization. That is why IT staff need to protect as many of their company's...

Researchers have determined that those who stole approximately $81 million from the Bangladesh Bank most likely did so by hacking into SWIFT's client software. SWIFT, or the Society for Worldwide Interbank Financial Telecommunications, provides banks and other organizations with secure messaging services. According to its 2015 traffic, more than 11...

In the fall of 2015, Heimdal Security detected a post-office email scam targeting unsuspecting Danish users. The campaign sent out fake emails purporting to originate from PostNord and Post Denmark. When clicked on, the infected emails downloaded Cryptolocker2 ransomware onto users' machines. Several months later, Heimdal has now spotted another...

According to reports, Sony will soon be introducing two-factor authentication to its popular gaming platform, the PlayStation Network. Although the company has yet to make an official announcement, Sony confirmed to the gaming news website Polygon that the security feature was in the works. "In order to further safeguard our users and their...

A security researcher successfully compromised a Facebook server only to discover that someone had already been there. Bug bounty hunter Orange Tsai explains in a blog post that after poking around some Class C IP addresses of "vpn.tfbnw.com," an internal domain for Facebook, he came across a special server with the name "files.fb.com." The...

By now, almost everyone knows what happened during the Target breach. In the late fall of 2013, a group of attackers uploaded card-stealing malware to a small number of point-of-sale (POS) terminals in the retailer's stores. That malware ultimately compromised some 40 million debit and credit card accounts over the span of about two weeks. In the...

The desktop edition of the Opera web browser is getting a free, built-in VPN offering users a more secure and private browsing experience. The feature, announced on Opera's blog, making it the first major browser to integrate a VPN service. Opera's built-in VPN, which is currently incorporated into the Windows and Mac developer editions of the...

The Massachusetts Institute of Technology (MIT), famed as one of the top tech schools in the country, introduced an “experimental” bug bounty program this week. The private, Cambridge-based research university is among the first academic institutions to announce a program designed to encourage finding...

2016 is shaping up to be the year of ransomware. Cyber-attacks are on the rise, with companies losing control of their critical assets. And the problem isn’t going away. Could your company fall victim to these malicious attacks? Everyone is vulnerable, but the good news is that there are simple steps you can take today using security tools you already...

Many of my friends having been dropping off the social media spectrum lately. Some have gone so far as to deactivate their social media accounts. They all have good reasons, and in some cases, I see them spending their time much more productively without worrying about the constant distraction of online socializing. None of them have received a...

Over the last year, Google detected nearly 800,000 compromised websites – roughly 16,500 new sites every week – exposing unsuspecting visitors to malware and scams. The search engine giant detailed the findings of a study it conducted alongside the University of California, Berkley, which analyzed 760,935 hijacking incidents from July 2014 to June...

I was on a security panel recently where we were asked to define the Internet of Things (IoT). This term is as vague as it is broad. It can be argued that it includes almost any “thing” that can be part of a network. I was not happy with any of our answers, including my own, so I spent some time thinking about it. When I was asked this question at a...